Incognito Tab Examination in Terms of Forensic Informatics

Hi there! nearly all of us use inconnito tab for some privacy as normal. But most of people when use incognito tab feel like no one see me , so i can do whatever i want. You think how is things going and how safe are we ?

In this article we are gonna find that answer les’t start.

Before we start i must give you pre-information to understand very well.

1- I built virtual machine on Vmware and i used windows 7 for minimum requirements

2- I’ve tried 3 various of browsers Chorome,Firefox,Opera also i have searched normal tab and incognito to see both of them.

3- First i took ram image (i will show you next article as soon as possible)

4- Then I turned off the virtual machine and i took normal image

I made a analysis above both in different browsers and by looking at the ram image and the normal image so that the result is clearer.

Let me share with you what i have searched incognito tabs.

Firefox Incognito tab’s picture 1.1

picture 1.1

Chorome Incognito tab’s picute 1.2 , 1.3 , 1.4

picture 1.2
picture 1.3
picture 1.4

Opera Incognito tab’s picture 1.5

picture 1.5

Results

I examined the ram image with the magnet axiom software and the results are as follows;

Evidence 1
Evidence 2
Evidence 3

As you can see above are ram image results.

Now let’s see what we have achieved with normal image

I examined the ram image with the autopsy software and the results are as follows;

Last Evidence

There is not even one evidence related incognito tab. Only found my regular searches.

Before we pass the results i want you to know what did I use while analyzing.

I use Vmware for virtual machine and windows 7 Ultimate version.

I use DumpIt for taking ram image and I used magnet axiom for analyzing

I used FTK Imager for taking image and I used Autopsy software for analyzing

As a result of my work;

•• I found that calls made from incognito tabs are not completely confidential.

•• I saw that taking physical images and examining them did not bring any results. It just found the normal searches I made. This means that the data of hidden tabs are in the ram. So it can be difficult to get hidden tab results after shutting down the computer

•• I learned that the ram image makes me see a few if not always

•• I hope you notice that I found the results in the Chrome opera browsers. But you can see that there is no result for firefox. It is up to you using which browser 🙂

Leave a comment